Welcome to the DevSecOps using Spotify Clone Application! This project is a modern web application that replicates the design patterns and functionality of Spotify. It is built using a robust tech stack that includes React, TypeScript, and Express. This project aims to deploy a functional replica of the Spotify app while emphasizing a DevSecOps approach. By integrating development, security, and operations throughout the application lifecycle, we ensure a robust and secure deployment process.
-
AWS Account: Required for deploying the application on AWS.
-
Github Account: For collaboration on the project.
-
Dockerhub Account: Necessary for storing and managing Docker images.
-
Git Bash Terminal: If you are using Windows 10/11 to ssh to AWS instance, Git Bash is recommended for executing command-line operations.
To get started with the DevSecops with Spotify Clone Application, clone the repository, install the necessary dependencies, and follow the setup instructions in the documentation.
Open Gitbash on your systam and follow:
mkdir <your-directory-name>
cd <your-directory-name>
git clone https://github.com/cybergauravv/DevSecOps-Spotify.git
-
Log in to the AWS Management Console
-
Navigate to EC2 Dashboard
-
Launch a New EC2 Instance
- This will open the “Launch an Instance” wizard.
-
Choose an Amazon Machine Image (AMI)
- In the
"Choose an Amazon Machine Image (AMI)"step, search for and select an Ubuntu AMI. You can choose the latest version of Ubuntu Server(e.g., Ubuntu Server 20.04 LTS).
- In the
-
Choose an Instance Type
- In the "Choose an Instance Type" step, select
t2.xlargefrom the list of instance types.
- In the "Choose an Instance Type" step, select
-
Configure Instance Details
- Configure the instance settings as needed. You can leave most settings as default for a basic setup.
- Ensure that you select the appropriate VPC and subnet if necessary.
-
Configure Storage
- In the "Configure Storage" step, you can adjust the storage size to your fit.
-
Create Security Group
- Create a new security group or select an existing one.
- Ensure to allow inbound traffic for the following ports:
- Create a new security group or select an existing one.
| Type | Protocol | Port Range | Source | Description |
|---|---|---|---|---|
| SSH | TCP | 22 | 0.0.0.0/0 | Allow SSH access |
| HTTP | TCP | 80 | 0.0.0.0/0 | Allow HTTP traffic |
| Custom TCP | TCP | 8080 | 0.0.0.0/0 | Allow traffic on port 8080 |
| Custom TCP | TCP | 3000 | 0.0.0.0/0 | Allow traffic on port 3000 |
| Custom TCP | TCP | 9000 | 0.0.0.0/0 | Allow traffic on port 9000 |
Jenkins will run on port 8080
SonarQube will run on port 9000
Spotify-Clone will run on port 3000
- After adding all the required rules, click on the "Save rules" button to apply the changes
-
Create a key pair login if you do not have existing and download the .pem file. Choose the key pair to ssh your instance.
-
Launch your instance
-
Wait a few moments for the instance to launch. You will see a confirmation screen with details about your instance.
-
Select your instance, and note the
Public IPv4 address. -
Open
Git Bashon your local machine and use the following command toSSHinto your instance:cd </path/to/your-key-file.pem> chmod 400 <your-key-pair.pem> ssh -i /path/to/your-key-file.pem ubuntu@<your-instance-ip>
-
- Switch to root user using
sudo su -
sudo apt install unzip -y
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
#!/bin/bash
sudo apt update -y
wget -O - https://packages.adoptium.net/artifactory/api/gpg/key/public | sudo tee /etc/apt/keyrings/adoptium.asc
echo "deb [signed-by=/etc/apt/keyrings/adoptium.asc] https://packages.adoptium.net/artifactory/deb $(awk -F= '/^VERSION_CODENAME/{print$2}' /etc/os-release) main" | sudo tee /etc/apt/sources.list.d/adoptium.list
sudo apt update -y
sudo apt install temurin-17-jdk -y
/usr/bin/java --version
curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee /usr/share/keyrings/jenkins-keyring.asc > /dev/null
echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian-stable binary/ | sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null
sudo apt-get update -y
sudo apt-get install jenkins -y
sudo systemctl start jenkins
sudo systemctl status jenkins
# Add Docker's official GPG key:
sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
# Add the repository to Apt sources:
echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin -y
sudo usermod -aG docker ubuntu
sudo chmod 777 /var/run/docker.sock
newgrp docker
sudo systemctl status docker
sudo apt-get install wget apt-transport-https gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy
docker login -u <your-dockerhub-username>
Password: <your-dockerhub-password>
curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- -b /usr/local/bin
aws --version
jenkins --version
docker --version
trivy --version
docker run -d --name sonarqube -p 9000:9000 sonarqube:lts-community
docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
<container_id> sonarqube:lts-community "/bin/sh -c 'exec ...'" 10 seconds ago Up 10 seconds 0.0.0.0:9000->9000/tcp sonarqube
sudo cat /var/lib/jenkins/secrets/initialAdminPassword
-
Eclipse TemurinSonarQube ScannerNodeJS.Docker CommonDocker APIDocker Build StepDocker PipelineOWASP Dependency-CheckEmail Extension TemplateBlue OceanPipeline Stage View
Steps to add credentials in Jenkins under the Credentials section, specifically for DockerHub and Docker Personal Access Token (PAT), SonarQube Token and Email-Notifications.
-
- Kind: Select
Username with password. - Scope: Leave as
Global (default). - Username: Enter your
DockerHub username. - Password: Enter your
DockerHub password. - ID: Enter
dockerhub-cred. - Description: Enter
DockerHub Authentication.
- Kind: Select
-
- Kind: Select
Secret Text - Scope: Leave as
Global (default). - ID: Enter
docker-pat. - Secret: Enter your
Personal Access Token - Description: Enter
Docker PAT.
- Kind: Select
-
We will implement email notifications in Jenkins using a Gmail account, configuring an app password for secure SMTP authentication to notify the status of pipeline results. Follow Blog.
| Tool | Name | Version | Installation Method |
|---|---|---|---|
| JDK Installation | JDK17 - Automatic Install - from adoptium.net | 17.8.1+1 | Automatic Install |
| SonarQube Scanner | SonarQube Scanner | Latest | Automatic Install |
| NodeJS | NodeJS 20.x | 20.9.0 | Automatic Install |
| OWASP Dependency-Check | OWASP-DC | Latest | Install from GitHub |
| Docker | Docker | Latest | Automatic Install from docker.com |
- Click
"Apply"&"Save"
-
Username:
admin, Password:admin
-
Project Key:
spotify-clone, Project Name:Spotify-clone
-
- Token Name:
sonarqube-token
- Token Name:
In this part of configuration we will configure "SonarQube Installations" and "Extended E-mail Notification" ` part.
- Enter SonarQube Details:
-
-
- Check
"Use SSL"and"Use OAuth 2.0".
pipeline {
agent any
environment {
DOCKER_IMAGE = 'your-dockerhub-username/spotify-clone'
DOCKER_TAG = "${BUILD_NUMBER}"
SONAR_PROJECT_KEY = 'spotify-clone'
REGISTRY_CREDENTIALS = credentials('dockerhub-cred')
DEPENDENCY_CHECK_REPORT = 'dependency-check-report.xml'
SCANNER_HOME = tool 'SonarScanner'
PATH = "$SCANNER_HOME/bin:$PATH"
}
tools {
nodejs 'NodeJS 20.x'
}
stages {
stage("Clean Workspace") {
steps {
cleanWs()
}
}
stage('Git Checkout') {
steps {
git branch: 'main', url: 'https://github.com/cybergauravv/DevSecOps-Spotify.git'
}
}
stage('Install Dependencies') {
steps {
sh 'npm ci --verbose'
}
}
stage('SonarQube Analysis') {
steps {
withSonarQubeEnv('SonarQube') {
sh """
sonar-scanner \
-Dsonar.projectKey=${SONAR_PROJECT_KEY} \
-Dsonar.sources=src \
-Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
"""
}
}
}
stage('Quality Gate') {
steps {
timeout(time: 5, unit: 'MINUTES') {
waitForQualityGate abortPipeline: true
}
}
}
stage('OWASP Dependency Check') {
steps {
dependencyCheck additionalArguments: '''
--scan ./
--format HTML
--format XML
--prettyPrint
--disableYarnAudit
--disableNodeAudit
''',
odcInstallation: 'OWASP-DC'
dependencyCheckPublisher pattern: DEPENDENCY_CHECK_REPORT
archiveArtifacts artifacts: DEPENDENCY_CHECK_REPORT, allowEmptyArchive: true
}
}
stage('Trivy File Scan') {
steps {
sh "trivy fs . > trivy.txt"
}
}
stage('Build Docker Image') {
steps {
script {
timeout(time: 5, unit: 'MINUTES') {
docker.build("${DOCKER_IMAGE}:${DOCKER_TAG}")
}
}
}
}
stage('Push to DockerHub') {
steps {
script {
timeout(time: 5, unit: 'MINUTES') {
docker.withRegistry('https://registry.hub.docker.com', 'dockerhub-cred') {
def image = docker.image("${DOCKER_IMAGE}:${DOCKER_TAG}")
image.push()
image.push('latest')
}
}
}
}
}
stage('Docker Scout Scan') {
steps {
timeout(time: 5, unit: 'MINUTES') {
withCredentials([string(credentialsId: 'docker-pat', variable: 'DOCKER_PAT')]) {
sh "echo $DOCKER_PAT | docker login -u cybersenseii --password-stdin"
sh """
docker-scout quickview ${DOCKER_IMAGE}:${DOCKER_TAG}
docker-scout cves ${DOCKER_IMAGE}:${DOCKER_TAG} --only-severity critical,high
docker-scout recommendations ${DOCKER_IMAGE}:${DOCKER_TAG}
"""
}
}
}
}
stage('Deploy to Container') {
steps {
script {
timeout(time: 5, unit: 'MINUTES') {
try {
sh """
docker stop spotify-clone || true
docker rm spotify-clone || true
docker pull ${DOCKER_IMAGE}:${DOCKER_TAG}
docker run -d \
--name spotify-clone \
--restart unless-stopped \
-p 3000:3000 \
${DOCKER_IMAGE}:${DOCKER_TAG}
"""
} catch (Exception e) {
currentBuild.result = 'FAILURE'
error "Deployment failed: ${e.message}"
}
}
}
}
}
}
post {
always {
script {
def sonarqubeUrl = ''
withSonarQubeEnv('SonarQube') {
sonarqubeUrl = env.SONAR_HOST_URL
}
emailext (
subject: "Pipeline Status: ${currentBuild.result}",
body: """
<html>
<body>
<h2>Build Status: ${currentBuild.result}</h2>
<h3>Build Details:</h3>
<ul>
<li>Build Number: ${BUILD_NUMBER}</li>
<li>Build URL: ${BUILD_URL}</li>
</ul>
<h3>Security Reports:</h3>
<p>Please find the attached security scan reports (if generated).</p>
<h3>SonarQube Results:</h3>
<p>View the SonarQube analysis results <a href='${sonarqubeUrl}/dashboard?id=${SONAR_PROJECT_KEY}'>here</a>.</p>
<h4>Build Logs:</h4>
<p>To view the full build logs, please check the build URL provided above.</p>
</body>
</html>
""",
to: 'your-email-here',
attachmentsPattern: "**/${DEPENDENCY_CHECK_REPORT}, **/trivy.txt",
mimeType: 'text/html'
)
}
cleanWs()
sh 'docker system prune -f'
}
success {
echo 'Pipeline completed successfully!'
}
failure {
echo 'Pipeline failed!'
}
}
}
This Jenkins pipeline automates the CI/CD process for the Spotify-Clone application, ensuring code quality, security, and deployment through a series of well-defined stages. This pipeline ensures that the Spotify-Clone application is built, tested for quality and security, and deployed efficiently, with notifications sent to stakeholders after each build.
To monitor a running build in Jenkins, you can utilize the Pipeline Stage View, Pipeline console view and the Console Output features. Jenkins updates the build status to indicate whether the build was successful, unstable, or failed. This status is visible in the build history and on the main job page.
You will receive an email trigger with the defined reports but if you wish to check your SonarQube Analysis you can check on your SonarQube server under Projects. You can work further on remediation of any triggered vulnerabilities, bugs or code smells.
- Open Your Browser and Enter the URL
http://<your-Instance-IP>:3000 - Press
Enterand watch as yourSpotify-Cloneapplication comes to life!
We're always looking for talented developers to join our ensemble and help make this Spotify Clone even more harmonious! Whether you're a frontend maestro, a backend virtuoso, or a DevSecOps conductor, there's a place for you in our orchestra.
- Fork the Melody: Start by forking this repository to your own GitHub account.
- Compose Your Changes: Create a new branch and add your magical musical features.
- Tune It Up: Ensure your code follows our style guide and passes all tests.
- Perform a Sound Check: Test your changes thoroughly.
- Submit Your Sonata: Create a pull request with a clear description of your improvements.
- Implement new audio features like equalizers or visualizers
- Enhance the user interface with animations and transitions
- Improve accessibility for users with different abilities
- Optimize performance for smoother playback
- Add social features for sharing and collaborating on playlists
- Implement AI-driven music recommendations
Remember, every contribution, no matter how small, adds to the beautiful music we're creating together. Let's make some noise! 🥁🎷🎺
🚀 Your journey through our DevSecOps pipeline has been music to our ears! 🎧
We hope this project has struck a chord with you and amplified your understanding of DevSecOps practices.
Keep the DevSecOps rhythm going and may your code always be in harmony!
Don't forget to leave a ⭐️ if you found this useful!